Add some relocation overflow checks for x86_64. 2016-02-05 Cary Coutant Andrew Senkevich gold/ PR gold/18695 * x86_64.cc (Target_x86_64::Relocate::relocate): Add overflow checking for R_X86_64_32, R_X86_64_32S, R_X86_64_PC32, and R_X86_64_PLT32. * testsuite/Makefile.am (x86_64_overflow_pc32): New test. * testsuite/x86_64_overflow_pc32.sh: New test script. * testsuite/x86_64_overflow_pc32.s: New source file. diff --git a/gold/testsuite/Makefile.am b/gold/testsuite/Makefile.am index 96d2b19..81f3464 100644 --- a/gold/testsuite/Makefile.am +++ b/gold/testsuite/Makefile.am @@ -1074,6 +1074,20 @@ x86_64_mov_to_lea13.stdout: x86_64_mov_to_lea13 x86_64_mov_to_lea14.stdout: x86_64_mov_to_lea14 $(TEST_OBJDUMP) -dw $< > $@ +check_SCRIPTS += x86_64_overflow_pc32.sh +check_DATA += x86_64_overflow_pc32.err +MOSTLYCLEANFILES += x86_64_overflow_pc32.err +x86_64_overflow_pc32.o: x86_64_overflow_pc32.s + $(TEST_AS) -o $@ $< +x86_64_overflow_pc32.err: x86_64_overflow_pc32.o gcctestdir/ld + @echo $(CXXLINK) -Bgcctestdir/ -shared -o x86_64_overflow_pc32 x86_64_overflow_pc32.o "2>$@" + @if $(CXXLINK) -Bgcctestdir/ -shared -o x86_64_overflow_pc32 x86_64_overflow_pc32.o 2>$@; \ + then \ + echo 1>&2 "Link of x86_64_overflow_pc32 should have failed"; \ + rm -f $@; \ + exit 1; \ + fi + endif DEFAULT_TARGET_X86_64 if DEFAULT_TARGET_I386 diff --git a/gold/testsuite/x86_64_overflow_pc32.s b/gold/testsuite/x86_64_overflow_pc32.s new file mode 100644 index 0000000..7494c53 --- /dev/null +++ b/gold/testsuite/x86_64_overflow_pc32.s @@ -0,0 +1,15 @@ + .data + .space 0x8ff00000 + .hidden foo + .globl foo +foo: + .byte 20 +local: + .byte 20 + .text + .globl bar + .type bar, @function +bar: + lea foo(%rip), %rax + lea local(%rip), %rax + .size bar, .-bar diff --git a/gold/testsuite/x86_64_overflow_pc32.sh b/gold/testsuite/x86_64_overflow_pc32.sh new file mode 100755 index 0000000..3a5bcba --- /dev/null +++ b/gold/testsuite/x86_64_overflow_pc32.sh @@ -0,0 +1,42 @@ +#!/bin/sh + +# x86_64_overflow_pc32.sh -- a test case for overflow checking. + +# Copyright (C) 2016 Free Software Foundation, Inc. +# Written by Cary Coutant . + +# This file is part of gold. + +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. + +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, +# MA 02110-1301, USA. + +check() +{ + if ! grep -q "$2" "$1" + then + echo "Did not find expected error in $1:" + echo " $2" + echo "" + echo "Actual error output below:" + cat "$1" + exit 1 + fi +} + +# We don't know how the compiler might order these variables, so we +# can't test for the actual offset from .data, hence the regexp. +check x86_64_overflow_pc32.err "function bar: error: relocation overflow" + +exit 0 diff --git a/gold/x86_64.cc b/gold/x86_64.cc index 4ad5afc..82bb658 100644 --- a/gold/x86_64.cc +++ b/gold/x86_64.cc @@ -3364,6 +3364,7 @@ Target_x86_64::Relocate::relocate( typename elfcpp::Elf_types::Elf_Addr address, section_size_type view_size) { + typedef Relocate_functions Reloc_funcs; const elfcpp::Rela rela(preloc); unsigned int r_type = elfcpp::elf_r_type(rela.get_r_info()); @@ -3444,6 +3445,8 @@ Target_x86_64::Relocate::relocate( break; } + typename Reloc_funcs::Reloc_status rstatus = Reloc_funcs::RELOC_OK; + switch (r_type) { case elfcpp::R_X86_64_NONE: @@ -3452,51 +3455,44 @@ Target_x86_64::Relocate::relocate( break; case elfcpp::R_X86_64_64: - Relocate_functions::rela64(view, object, psymval, addend); + Reloc_funcs::rela64(view, object, psymval, addend); break; case elfcpp::R_X86_64_PC64: - Relocate_functions::pcrela64(view, object, psymval, addend, + Reloc_funcs::pcrela64(view, object, psymval, addend, address); break; case elfcpp::R_X86_64_32: - // FIXME: we need to verify that value + addend fits into 32 bits: - // uint64_t x = value + addend; - // x == static_cast(static_cast(x)) - // Likewise for other <=32-bit relocations (but see R_X86_64_32S). - Relocate_functions::rela32(view, object, psymval, addend); + rstatus = Reloc_funcs::rela32_check(view, object, psymval, addend, + Reloc_funcs::CHECK_UNSIGNED); break; case elfcpp::R_X86_64_32S: - // FIXME: we need to verify that value + addend fits into 32 bits: - // int64_t x = value + addend; // note this quantity is signed! - // x == static_cast(static_cast(x)) - Relocate_functions::rela32(view, object, psymval, addend); + rstatus = Reloc_funcs::rela32_check(view, object, psymval, addend, + Reloc_funcs::CHECK_SIGNED); break; case elfcpp::R_X86_64_PC32: case elfcpp::R_X86_64_PC32_BND: - Relocate_functions::pcrela32(view, object, psymval, addend, - address); + rstatus = Reloc_funcs::pcrela32_check(view, object, psymval, addend, + address, Reloc_funcs::CHECK_SIGNED); break; case elfcpp::R_X86_64_16: - Relocate_functions::rela16(view, object, psymval, addend); + Reloc_funcs::rela16(view, object, psymval, addend); break; case elfcpp::R_X86_64_PC16: - Relocate_functions::pcrela16(view, object, psymval, addend, - address); + Reloc_funcs::pcrela16(view, object, psymval, addend, address); break; case elfcpp::R_X86_64_8: - Relocate_functions::rela8(view, object, psymval, addend); + Reloc_funcs::rela8(view, object, psymval, addend); break; case elfcpp::R_X86_64_PC8: - Relocate_functions::pcrela8(view, object, psymval, addend, - address); + Reloc_funcs::pcrela8(view, object, psymval, addend, address); break; case elfcpp::R_X86_64_PLT32: @@ -3510,8 +3506,8 @@ Target_x86_64::Relocate::relocate( // Note: while this code looks the same as for R_X86_64_PC32, it // behaves differently because psymval was set to point to // the PLT entry, rather than the symbol, in Scan::global(). - Relocate_functions::pcrela32(view, object, psymval, addend, - address); + rstatus = Reloc_funcs::pcrela32_check(view, object, psymval, addend, + address, Reloc_funcs::CHECK_SIGNED); break; case elfcpp::R_X86_64_PLTOFF64: @@ -3522,14 +3518,13 @@ Target_x86_64::Relocate::relocate( typename elfcpp::Elf_types::Elf_Addr got_address; // This is the address of GLOBAL_OFFSET_TABLE. got_address = target->got_plt_section()->address(); - Relocate_functions::rela64(view, object, psymval, - addend - got_address); + Reloc_funcs::rela64(view, object, psymval, addend - got_address); } break; case elfcpp::R_X86_64_GOT32: gold_assert(have_got_offset); - Relocate_functions::rela32(view, got_offset, addend); + Reloc_funcs::rela32(view, got_offset, addend); break; case elfcpp::R_X86_64_GOTPC32: @@ -3537,7 +3532,7 @@ Target_x86_64::Relocate::relocate( gold_assert(gsym); typename elfcpp::Elf_types::Elf_Addr value; value = target->got_plt_section()->address(); - Relocate_functions::pcrela32(view, value, addend, address); + Reloc_funcs::pcrela32(view, value, addend, address); } break; @@ -3546,7 +3541,7 @@ Target_x86_64::Relocate::relocate( // R_X86_64_GOTPLT64 is obsolete and treated the the same as // GOT64. gold_assert(have_got_offset); - Relocate_functions::rela64(view, got_offset, addend); + Reloc_funcs::rela64(view, got_offset, addend); break; case elfcpp::R_X86_64_GOTPC64: @@ -3554,7 +3549,7 @@ Target_x86_64::Relocate::relocate( gold_assert(gsym); typename elfcpp::Elf_types::Elf_Addr value; value = target->got_plt_section()->address(); - Relocate_functions::pcrela64(view, value, addend, address); + Reloc_funcs::pcrela64(view, value, addend, address); } break; @@ -3563,7 +3558,7 @@ Target_x86_64::Relocate::relocate( typename elfcpp::Elf_types::Elf_Addr value; value = (psymval->value(object, 0) - target->got_plt_section()->address()); - Relocate_functions::rela64(view, value, addend); + Reloc_funcs::rela64(view, value, addend); } break; @@ -3582,7 +3577,7 @@ Target_x86_64::Relocate::relocate( && Target_x86_64::can_convert_mov_to_lea(gsym)))) { view[-2] = 0x8d; - Relocate_functions::pcrela32(view, object, psymval, addend, + Reloc_funcs::pcrela32(view, object, psymval, addend, address); } else @@ -3601,7 +3596,7 @@ Target_x86_64::Relocate::relocate( } typename elfcpp::Elf_types::Elf_Addr value; value = target->got_plt_section()->address() + got_offset; - Relocate_functions::pcrela32(view, value, addend, address); + Reloc_funcs::pcrela32(view, value, addend, address); } } break; @@ -3611,7 +3606,7 @@ Target_x86_64::Relocate::relocate( gold_assert(have_got_offset); typename elfcpp::Elf_types::Elf_Addr value; value = target->got_plt_section()->address() + got_offset; - Relocate_functions::pcrela64(view, value, addend, address); + Reloc_funcs::pcrela64(view, value, addend, address); } break; @@ -3651,6 +3646,10 @@ Target_x86_64::Relocate::relocate( break; } + if (rstatus == Reloc_funcs::RELOC_OVERFLOW) + gold_error_at_location(relinfo, relnum, rela.get_r_offset(), + _("relocation overflow")); + return true; }